Description

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T23:16:24.297Z",
  "pubdate": "2026-08-21T23:16:24.297Z",
  "executiveSummary": "An unauthenticated arbitrary file deletion vulnerability exists in Combodo iTop prior to version 3.2.3. The security flaw allows remote, unauthenticated threat actors to target and delete the .readonly file residing on vulnerable iTop instances. This specific file is natively generated during the initial application setup process and acts as a critical system guard to prevent users from executing write actions or modifying application state.\nSuccessful exploitation of this vulnerability compromises the integrity of the application's operational state by removing the enforcement mechanism that restricts write operations. Consequently, unauthorized entities can induce state changes, potentially leading to unauthorized data modification or administrative bypasses depending on subsequent application handling. The attack vector requires no prior authentication or specialized privileges, lowering the threshold for exploitation against exposed web interfaces running affected version ranges. Remediation requires updating the software to version 3.2.3, where the vulnerability has been officially patched by the vendor.",
  "technicalDetails": "The vulnerability stems from improper input validation or insufficient access control mechanisms within the application routing or file handling subsystems of Combodo iTop prior to version 3.2.3. Specifically, the component responsible for managing or interacting with the setup-generated .readonly file fails to enforce proper authentication and authorization checks. Under normal operational parameters, the .readonly file functions as a state-locking mechanism designed to restrict write actions and preserve system integrity post-installation.\nThe attack flow proceeds as follows: an unauthenticated attacker leverages network exposure to send a crafted HTTP request directly targeting the application endpoint or file manipulation routine associated with the .readonly file. Due to the absence of access control enforcement, the server processes the request without validating whether the sender possesses administrative privileges or session context. As a result, the application executes the deletion routine against the target file path, successfully removing the .readonly file from the file system.\nPost-exploitation, the removal of the .readonly file strips away the application's write-action protection mechanism. This alters the intended security posture of the iTop instance, transitioning the system from a read-restricted state to one where subsequent actions that normally require validation or are otherwise blocked may be permitted, depending on the broader application logic. The affected component is the installation and state-management subsystem across Combodo iTop versions prior to 3.2.3. Exploitation is performed entirely over the network via standard HTTP protocols without requiring any pre-existing credentials, administrative roles, or interaction from authenticated users."
}